Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links

高 7.4CVE-2026-45245 · GHSA-2r69-qgv3-hr65 · 18/05/2026 公開 · 14/10/2026 更新

要点

CVE-2026-45245 は summarize (steipete), @steipete/summarize に影響する深刻度「高」 (CVSS 7.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.33%（全脆弱性の 26.3% より高い）。
対処：0.15.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
summarize steipete	`< 0.15.1`	`0.15.1`
@steipete/summarize npm	`< 0.15.1`	`0.15.1`

概要

Summarize prior to 0.15.0 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness. Attackers can place local or private-network URLs behind hoverable links to route authenticated requests through the daemon, potentially accessing sensitive internal endpoints when users interact with attacker-controlled content.

NVD の説明

Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness. Attackers can place local or private-network URLs behind hoverable links to route authenticated requests through the daemon, potentially accessing sensitive internal endpoints when users interact with attacker-controlled content.